Full Disclosure mailing list archives
Re: Windows 7 UAC compromised
From: "Elazar Broad" <elazar () hushmail com>
Date: Fri, 06 Feb 2009 09:53:41 -0500
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Exactly, so we only make him click for non system applets/utilities, and we determine that by digital signatures, which is exactly how UAC is implemented in Windows 7. With that said, now we are back to the original issue, a computer is only as smart(or dumb, my apologies to the AI crowd) as the guy who programmed it, or in other words, how hard(or easy) is it to spoof a system applet/utility? Human nature dictates(most of the time) that we can become desensitized to things that are routine or occur often, in other words, the more UAC prompts, the more blind clicking, then again, did Joe Sixpack bother to read the first UAC prompt when he started up his shiny new Vista for the 1st time. Now, if we wired UAC up to a mouse with an electrode embedded in the left mouse button, we might have a solution. Of course the voltage would need to increase slightly over the life of the mouse in order to solve the blind shock and click problem... elazar On Fri, 06 Feb 2009 05:57:03 -0500 Yudi Rosen <yr42.lists () gmail com> wrote:
But Joe the Plumber doesn't want to have to click on endless 'confirm' dialogs every time he tries to use the computer. Simply having him run as a non-admin user only fixes half the problem. On Thu, Feb 5, 2009 at 9:17 PM, Jimmy Astle <astle.j () gmail com> wrote:I am new to the list so hello to everyone..... Now for the Windows 7 UAC stuff. 1.) Its beta.... its not going to be perfect wait for RC1 beforeselling 7down the river. 2.) http://www.informationweek.com/news/security/app-security/showArticle.jhtml?articleID=213001021&subSection=NewsIt all comes back to windows biggest issue, joethe plumbershouldn't not be running as a local admin on his box. UACproblem solved! Istill dont see how redmond missed the concept. On Thu, Feb 5, 2009 at 1:52 PM, Miller Grey<vigilantgregorius () gmail com>wrote:...what? On Tue, Feb 3, 2009 at 3:40 PM, M.B.Jr.<marcio.barbado () gmail com> wrote:Windows says: Hello world! Check this out, world, this isreally cool.Now I have, uh, something like, uh, "privileges management"! "UAC" is no more than a new commercial designation forsomething withabout 40 years. And they (Redmond) are still missing the concept's point. On Mon, Feb 2, 2009 at 5:14 PM, Christopher Pritchard <mailinglist () brainiacghost co uk> wrote:The biggest issue here is that although it's technicallyeasy to fixthis problem (just have UAC issue an alert when somebody'smessingwiththe system settings), it involves doing more of what endusers dislikemost about UAC (it issuing alerts to Joe Sixpack all thetime when hedoes something bone-headed security-wise). Fixing this one in a way that users will put up with willbe a bitch.Why not just have it not prompt if you are changingsettings, exceptfor UAC settings? that would be the simple way around it_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.htmlHosted and sponsored by Secunia - http://secunia.com/-- Marcio Barbado, Jr. _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
-----BEGIN PGP SIGNATURE----- Charset: UTF8 Note: This signature can be verified at https://www.hushtools.com/verify Version: Hush 3.0 wpwEAQECAAYFAkmMTvUACgkQi04xwClgpZib+AP9F9nse7R1YZxa1t5lfhxt7ifdsJ2g AQqj8gU3WRA2jFirU8uSCr0gNms7thdGUr9E47k8Rex2oglcuaThA/UM2CV0q+WRWyRN l9ufwQu8HhndZA/aNqjdWbubXRRUFB8x0utY2lKFdbFiiqvk7ogztZ96DzK1Ujhf/HKC IGp3Dlg= =OLph -----END PGP SIGNATURE----- -- Love Graphic Design? Find a school near you. Click Now. http://tagline.hushmail.com/fc/PnY6qxunKhUCWeXBZzoDmEq2Rrpr2dhlILwZbiXAUOMw578dWAklS/ _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Re: Windows 7 UAC compromised, (continued)
- Re: Windows 7 UAC compromised Kevin Wilcox (Feb 05)
- Re: Windows 7 UAC compromised Miller Grey (Feb 05)
- Re: Windows 7 UAC compromised Kevin Wilcox (Feb 05)
- Re: Windows 7 UAC compromised Miller Grey (Feb 05)
- Re: Windows 7 UAC compromised M.B.Jr. (Feb 05)
- Re: Windows 7 UAC compromised Jimmy Astle (Feb 06)
- Re: Windows 7 UAC compromised Valdis . Kletnieks (Feb 05)
- Re: Windows 7 UAC compromised M.B.Jr. (Feb 05)
- Re: Windows 7 UAC compromised Yudi Rosen (Feb 06)
- Re: Windows 7 UAC compromised Kevin Wilcox (Feb 06)